View | Details | Raw Unified | Return to bug 37018
Collapse All | Expand All

(-)a/Koha/REST/Plugin/Query.pm (-1 / +65 lines)
Lines 187-192 Generates the DBIC join attribute based on extended_attributes query entries, an Link Here
187
        }
187
        }
188
    );
188
    );
189
189
190
=head3 dbic_validate_operators
191
192
    $attributes = $c->dbic_validate_operators({ filtered_params => $filtered_params });
193
194
Validate operators in the passed query.
195
196
=cut
197
198
    $app->helper(
199
        'dbic_validate_operators' => sub {
200
            my ( $c, $args ) = @_;
201
            _validate_query($args->{filtered_params});
202
        }
203
    );
204
190
=head3 _build_query_params_from_api
205
=head3 _build_query_params_from_api
191
206
192
    my $params = _build_query_params_from_api( $filtered_params, $reserved_params );
207
    my $params = _build_query_params_from_api( $filtered_params, $reserved_params );
Lines 641-644 sub _rewrite_related_metadata_query { Link Here
641
    return $extended_attributes_entries;
656
    return $extended_attributes_entries;
642
}
657
}
643
658
659
=head3 _validate_operator
660
661
=cut
662
663
sub _validate_operator {
664
    my ($operator) = @_;
665
    my %allowed_operators = map { $_ => 1 } qw(= != < > <= >= like -not_like -in -ident -bool -not_bool -or);
666
    die "Invalid operator: $operator" unless exists $allowed_operators{$operator};
667
    return;
668
}
669
670
=head3 _validate_query
671
672
=cut
673
674
sub _validate_query {
675
    my ($query) = @_;
676
677
    if ( ref $query eq 'HASH' ) {
678
        for my $field ( keys %$query ) {
679
            my $value = $query->{$field};
680
681
            if ( ref $value eq 'HASH' ) {
682
683
                # Hash reference with operators
684
                for my $operator ( keys %$value ) {
685
                    _validate_operator($operator);
686
                }
687
            } elsif ( ref $value eq 'ARRAY' ) {
688
689
                # Array reference with operator as the first element
690
                _validate_query($value);
691
            } else {
692
693
                # Simple key-value pairs (no operator to validate)
694
            }
695
        }
696
    } elsif ( ref $query eq 'ARRAY' ) {
697
698
        # Top-level OR combination or nested AND combination
699
        for my $element (@$query) {
700
            if ( ref $element eq 'ARRAY' && $element->[0] eq '-and' ) {
701
                _validate_query( $element->[1] );
702
            } else {
703
                _validate_query($element);
704
            }
705
        }
706
    }
707
}
708
644
1;
709
1;
645
- 

Return to bug 37018